HPE iLO 4 / iLO 5 / iLO 6 (remote cross-site scripting): Cross-site scripting in the iLO web interface across all three

Impact

Cross-site scripting in the iLO web interface across all three current generations. The reason a browser bug scores this high on a BMC is that the victim is an operator with an authenticated iLO session: script running in that session can drive the same actions the operator can - mount Virtual Media, change boot order, power-cycle, create accounts - from the operator's own browser and credentials. It converts a phishing link into out-of-band control of a node without the attacker ever needing network reachability to the iLO themselves.

Who can reach it

Requires tricking an authenticated operator into loading attacker-controlled content while they hold an iLO session. The attacker does not need to reach the management VLAN at all - the operator's browser is the bridge, which is precisely why 'the BMCs are on an isolated network' is not a complete answer.

What to do

Flash iLO 4 to v2.82, iLO 5 to v2.78, or iLO 6 to v1.20 or later. Out-of-band, per-node, no host reboot and no job drain. Operational controls that help independently: use a dedicated browser profile or a privileged access workstation for BMC administration, and do not leave iLO sessions open in a browser that also handles general web traffic and email.

References